Defining an Information Security Governance Program CCISO Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A CISO is preparing for an annual board meeting and wants to ensure that the board understands its role in security governance. Which statement best describes the board's responsibility?

   • AThe board is responsible for configuring firewalls and intrusion detection systems.
   • BThe board approves the security strategy and monitors its implementation through regular reports.
   • CThe board should conduct daily security incident response activities.
   • DThe board should only be informed after a major breach occurs.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company's business strategy is to rapidly acquire smaller competitors to expand market share. The CISO must align the security governance program with this aggressive growth strategy while managing integration risks. Which approach best balances these priorities?

   • ADevelop a security due diligence playbook for acquisitions and integrate acquired companies into the governance framework within a defined timeline.
   • BDelay security integration until the acquired company is fully operational to avoid disrupting the acquisition.
   • CExempt acquired companies from the governance program for the first year to reduce friction.
   • DApply the same security policies to all acquired companies immediately without exception.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A retail company is launching an aggressive digital transformation initiative to increase online sales. The CISO must ensure that the security governance program supports this business strategy rather than hindering it. What is the most effective approach?

   • AIntegrate security risk assessments into the project lifecycle for digital initiatives and align security investments with the company's growth objectives.
   • BRequire all new digital projects to pause until a full security audit is completed.
   • CAllocate the security budget equally across all business units regardless of their digital plans.
   • DLet each business unit decide its own security requirements without central oversight.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A company is defining the governance structure for its security program. The CEO has asked the CISO to clarify who is ultimately accountable for ensuring that security risks are managed in line with business objectives. According to governance principles, who holds that accountability?

   • AThe head of internal audit
   • BThe board of directors
   • CThe chief information officer (CIO)
   • DThe CISO
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which of the following is an essential component of an information security governance program?

   • AA set of security policies and standards
   • BA network diagram
   • CA single security software product
   • DA list of employee passwords
   Reveal Solution Discussion Select an answer first